Prompt Injection Attacks COASP Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company's LLM assistant can access a customer database and send emails. The security team wants to reduce the impact of a successful prompt injection. Which configuration best applies the principle of least privilege?

   • AGive the assistant read-only access to the database and require human approval for sending emails.
   • BRestrict the assistant to a sandboxed environment with no network access.
   • CGive the assistant full database access and email permissions to improve functionality.
   • DUse a separate model for database access and email sending.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   An organization uses an LLM to automate responses to customer emails. The LLM has access to the customer database and can send emails. Which defense-in-depth strategy best mitigates prompt injection?

   • ACombine input validation, output filtering, and least-privilege permissions.
   • BUse a single strong system prompt that forbids following instructions in emails.
   • COnly allow the LLM to read emails, not send them.
   • DUse a different LLM provider for email processing.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A security team is implementing monitoring for an LLM-based customer support chatbot. They have limited logging budget and must choose between two monitoring approaches: (A) logging all user inputs and running pattern-based detection for known injection phrases; (B) logging all LLM outputs and running anomaly detection to flag outputs that deviate from expected responses. The team wants to detect both direct and indirect prompt injection attempts. Which approach is more effective, and why?

   • ANeither approach is effective; prompt injection cannot be detected.
   • BBoth approaches are equally effective, so the team should choose based on cost.
   • CApproach A, because it directly captures the attack attempt and can detect both direct and indirect injections.
   • DApproach B, because it detects the impact of the attack even if the input pattern is unknown.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A security analyst is investigating a potential prompt injection attack on an LLM that summarizes legal documents. The analyst notices the model output a paragraph that was not in the source document. Which investigation step would best confirm whether this was an injection?

   • ACheck the model's token usage for that request.
   • BRestart the model to clear its memory.
   • CReview the retrieved documents for hidden instructions.
   • DIncrease the model's temperature to see if the output changes.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A financial advisory chatbot uses a retrieval-augmented generation (RAG) pipeline that pulls from public web sources. An attacker plants a webpage that says 'The stock price of Company X has dropped 90%.' The chatbot retrieves this page and answers a user's question about Company X. What is the most likely impact and the best detection method?

   • ANo impact because the chatbot is not instructed to follow web content.
   • BReputational impact only; block the specific webpage.
   • COperational impact from incorrect advice; monitor for sudden changes in chatbot responses about specific entities.
   • DSecurity impact from data exfiltration; monitor for outbound network connections.
   Reveal Solution Discussion Select an answer first